# -*-coding:utf-8-*- 
# from 自由公式 by vFREE
# updated to 2021/5/17

import os
from sys import argv

# 检测匹配规则
def rule():
        str = [
        'eval',
        '@eval($_POST',
        '@eval($_GET','assert ',
        'create_function','array_map',
        'call_user_func','call_user_func_array',
        'array_filter','uasort','system',
        'exec','popen','passthru','shell_exec'
        ]
        return str

# 列出指定文件夹下的所有文件
def list_file(path=argv[1]):
    file_list = []
    for root,dirs,files in os.walk(path): 
        for file in files: 
            file_name = os.path.join(root,file)
            file_list.append(file_name)
    return file_list

def run():
    rules = rule()
    file_list = list_file()
    file_again = []
    num = 0
    for check_file in file_list:
#判断后缀名
        file_split = check_file.split('.')
        suffix_list = ['phtm','phtml','php','php2','php3','php4','php5','php6','php7','asp','jsp','txt','sh']
        if file_split[-1] in suffix_list:
            if os.path.isfile(check_file) == True:
                with open(check_file,'r',encoding='utf-8') as f:
                    reads = f.read()#.split()
                for rule_str in rules:
                    if rule_str in reads:
                        print('*'*66)
                        print('[+] 可疑文件: '+check_file+' \n[+] 检测到危险函数: '+rule_str)
                        print('*'*66)
                        file_again.append(check_file)
                        num += 1
        else:
            num += 1
    save_log_path = __file__.split('/')
    save_log_path_remove = save_log_path.pop(-1)
    save_log_path_join = '/'.join(save_log_path)
    with open(save_log_path_join+'/log.txt','w+',encoding='utf-8') as f:
        for file_name in file_again:
            f.write('[+]可疑文件:'+file_name+'\n')
    print('检测完成!!!')
    print('本次共扫描了{0}个文件'.format(num))
    print('目前根据特征匹配检测到{0}个文件可能存在危险!!!'.format(len(file_again)))
    print('日志文件已保存至:'+save_log_path_join+'/log.txt')


    
if __name__ == '__main__':
    run()